babysit lease store is not a real contention primitive across concurrent lanes

[kyle-sexton]

Filed by the autonomous babysit merge lane (AI-generated) after observing it live.

What happened

Two sessions were draining this repo's PR queue at the same time — a primary lane and a secondary lane. The secondary lane used the plugin's own worker-lease store as its contention primitive:

python manage_babysit_lease.py acquire --scope worker --pr melodic-software/claude-code-plugins#N --state-dir <state-dir>

Every acquire returned "acquired": true with "reclaimed_stale": false, including for PRs the other session was demonstrably working. Listing the store confirmed why:

$ ls <state-dir>/active-workers/
melodic-software__claude-code-plugins__pr-1305.json.lock
melodic-software__claude-code-plugins__pr-1306.json.lock
melodic-software__claude-code-plugins__pr-1311.json.lock

Only the lease-taking session's own leases were ever present. The other session never acquired any — it was driving PRs from its own worktrees (C:/Projects/melodic/worktrees/* and a session scratchpad) without going through manage_babysit_lease.py at all.

Why it matters

reference/orchestration.md treats the worker lease as the deterministic exclusion that keeps two lanes off the same PR, and babysit-prs lists lease contention as one of the few permitted deterministic exclusions from fan-out. But the lease is only binding on participants that opt into it. A session that runs the skill from a different worktree root, a session driving PRs by hand, or any lane that simply does not call the lease manager, is invisible to it — and an uncontended acquired: true reads exactly like a genuine all-clear.

The failure mode is not theoretical: two lanes can check out the same branch, push to the same PR, and race the same merge gate, each believing the lease proved it had exclusive ownership.

What the secondary lane had to fall back on

Neither of these is a lock, and both are heuristics:

1. PR activity recency (a widened grace window over updatedAt).
2. git worktree list — treating any branch already checked out somewhere on disk as claimed.

Worktree presence is the stronger of the two, and notably it is observable state the lease store already could have consulted but does not.

Possible directions (not a decision)

• Make the lease store authoritative by having every mutating path acquire it, and fail closed when it cannot.
• Have acquire additionally consult git worktree list for the target branch and refuse (or warn loudly) when the branch is checked out by an unleased worktree.
• Distinguish "no lease exists" from "exclusivity proven" in the acquire result, so a caller cannot read the former as the latter.
• Document explicitly that the lease binds only cooperating sessions, so lanes stop treating it as a guarantee.

Notes

No merge collision actually occurred — the secondary lane yielded on worktree-presence and activity-recency signals instead. This is filed as a latent correctness gap in the contention design, not an incident.

Deliberately filed without a work-class label; that classification belongs to triage.

[kyle-sexton]

This was generated by AI during triage.

Triage

Verified. Read plugins/source-control/skills/babysit-prs/scripts/manage_babysit_lease.py and confirmed the design the report describes: acquire takes a file lock scoped under --state-dir, and nothing in the codebase forces a mutating merge/queue path to go through it. A session that never calls manage_babysit_lease.py — different worktree root, hand-driven PRs, or any lane that just skips it — is invisible to the lock, and its acquired: true result is indistinguishable from genuine mutual exclusion. reference/orchestration.md documents the lease as the deterministic exclusion primitive, which overstates what the current implementation actually guarantees.

Classification: Bug (the orchestration contract's own claim — deterministic exclusion — does not hold against a non-cooperating participant; this is a documented-guarantee-vs-actual-behavior mismatch, not a feature gap), priority: high (same risk class as #1295 — a concurrent-lane correctness gap in merge orchestration; no incident occurred here only because the second lane happened to fall back to weaker heuristics that yielded), work-class: structural.

Routing: human-gated — genuinely open design space, not a single-fork decision. The issue's own "Possible directions" section lists four architecturally distinct responses that trade off differently:

1. Make the lease authoritative by forcing every mutating path through it and failing closed when it can't be acquired — the strongest guarantee, but changes the failure mode of every caller (a lock-store outage now blocks merges that currently proceed).
2. Have acquire additionally consult git worktree list and refuse/warn on an unleased checkout — narrows the gap for the specific failure mode observed here, but is a heuristic layered on the lock, not exclusivity.
3. Distinguish "no lease exists" from "exclusivity proven" in the acquire result — a smaller, more local change, but only relabels the guarantee rather than closing the gap.
4. Document that the lease binds only cooperating sessions and stop treating it as a guarantee — no code change, but downgrades what reference/orchestration.md and babysit-prs currently promise.

These aren't reversible/maintainer-vetoable variants of one answer — they're different products with different cost/guarantee trade-offs, several with cross-cutting blast radius across every mutating path in the babysit-prs lane. That's the human-gated bar (open design space + cross-repo/cross-lane policy), matching how #1295 (fixed-telemetry-title clobber, same concurrent-lane risk family) was routed.

Not a decision-carrier cluster with #1295 or #1348: #1295 is a different mechanism (telemetry sentinel/title clobber in work-loop), and #1348 is a different mechanism entirely (admission-gate re-queue in work-items). All three share a pattern — concurrent-lane assumptions not holding — but resolving this issue's decision does not resolve theirs or vice versa, so each stays independently human-gated rather than merged into one carrier.

Agent Brief (for the human who picks this up)

Type: Bug
Summary: The babysit-prs worker/queue lease store is a cooperative lock, not an authoritative contention primitive — it only excludes participants that opt into calling it, so a session bypassing the lease manager (different worktree root, hand-driven PRs, or any lane that skips the call) is invisible to it, and its acquired: true reads identically to genuine exclusivity.

Current behavior: acquire returns "acquired": true, "reclaimed_stale": false whenever no other lease-taking participant currently holds the lock — it has no way to detect or refuse a non-cooperating participant already working the same PR/branch by other means (e.g. an already-checked-out worktree). reference/orchestration.md and the babysit-prs skill currently document this lease as the deterministic exclusion that keeps two lanes off the same PR.

Desired behavior: A human-made decision on which of the four directions above (or a combination, or another option) the lease store adopts, followed by the corresponding change: either the lease becomes authoritative for every mutating path (fail closed when unavailable), it additionally consults observable state like git worktree list to catch non-cooperating participants, its result type stops conflating "uncontended" with "proven exclusive," or the documentation is downgraded to state plainly that it binds only cooperating sessions.

Key interfaces:

• The lease acquire/heartbeat/release result shape (currently a flat {"acquired": bool, "reclaimed_stale": bool, ...}) — whichever direction is chosen may need this shape to carry a stronger or weaker claim.
• Every mutating entry point in the babysit-prs lane (merge, queue-processing) — the decision determines whether these gain a mandatory lease-acquire-or-fail-closed step.
• reference/orchestration.md's statement of what the lease guarantees — must be brought into agreement with whatever the code actually does after this decision.

Acceptance criteria:

• A decision is recorded on which of the four directions (or another concrete option) the lease store adopts.
• The chosen direction is implemented (or, if the chosen direction is doc-only, reference/orchestration.md is updated to state the lease's actual, narrower guarantee).
• reference/orchestration.md's exclusion claim matches the lease store's actual behavior after the change.

Out of scope:

• Retroactively auditing past sessions for undetected collisions — no collision is known to have occurred; this is a latent-gap fix, not incident remediation.
• Changing the PR-activity-recency or git worktree list heuristics the secondary lane already uses as a stopgap, except as required by whichever direction is chosen.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned for this drain wave.

The worker-lease store observation is recorded and the mitigation is operational: do not run two babysit merge lanes against the same PR queue without an external contention primitive. A durable cross-lane lease design belongs to the lane-runtime resilience carrier (#535) and concurrent worktree/lane hygiene program (#778), not this one-off filing.

Re-open trigger: A design brief for a real cross-process contention primitive with acceptance tests under concurrent lane load.